This privacy policy is intended for all website visitors (i) (https://combine-consulting.com) and applicants (ii).
This privacy policy explains how your personal data are processed in conjunction with a visit to the website (or an application you submit) and what rights and options you have in this regard. “Personal data” means any information relating to an identified or identifiable natural person.
1.1 Name and contact details of controller
The controller – for processing operations taking place under this privacy policy – within the meaning of Article 4 (7) of the EU General Data Protection Regulation (GDPR) is:
combine Consulting GmbH
Leopoldstraße 28 a, 80802 München, Deutschland
T. +49 89 416 12 12 0
E. info@combine-consulting.com
combine Consulting is referred to hereinafter as "we" or "us".
1.2 Data protection officer
The data protection officer of combine Consulting can be reached at:
E. datenschutz@dataguard.de
Processing of personal data by us
This section discusses the processing activities carried out via the website and selected processing outside this website for which combine Consulting is the controller. Based on the nature of the personal data in question, it explains for which purposes and on what legal basis the personal data are processed and for how long the personal data are stored.
2.1 Website visits for purely informational purposes
If you visit the website for purely informational purposes without actively providing data in any way, only the Internet connection data that your browser transmits to our server are processed.
Nature of personal data
Server-Log-Dateien Browsertyp und Browserversion; verwendetes Betriebssystem; Internet-Service Provider des Besuchers; IP-Adresse; Datum und Uhrzeit der Serveranfrage; Referrer-URL; Websites, die der Besucher über unsere Website aufruft.
Purposes of processing and legal basis
When our website is visited, information is automatically processed in what are known as server log files, which your browser automatically transmits to us. These data are collected both for the purpose of future optimization of our online presence and for data protection control and data security. The data are not analyzed for marketing purposes in this context.
Die Verarbeitung dieser Daten erfolgt gemäß Art. 6 Abs. 1 lit. f DSGVO.
The data are erased once they are no longer required for the purpose for which they were collected. In the case of collection of data to provide the website, this is the case when the relevant session has been terminated. In the case of storage of the data in server log files, it is the case after not more than seven days. It is possible that data will be stored beyond that time. In that case, the IP addresses are erased or distorted so it is no longer possible to associate the information with the accessing client.
Die unter der Ziffer 2.1 aufgeführten personenbezogenen Daten werden automatisch beim Besuch der Website durch unsere IT-Systeme erfasst. Ohne eine Verarbeitung der personenbezogenen Daten kann die Website gegebenenfalls nicht optimal dargestellt werden.
2.2 Kontakt per Kontaktformular/ E-Mail
Wenn Sie uns mittels Kontaktformular oder per E-Mail kontaktieren, z. B. um über unsere Produkte und Dienstleistungen mehr zu erfahren sowie bei sonstigen Anfragen von Ihnen, verarbeiten wir die nachfolgend aufgeführten personenbezogenen Daten.
Art der personenbezogenen Daten
Contact form/e mail
Angegebene Kontaktdaten (Name, Telefonnummer, Adresse, Grund für die Kontaktaufnahme usw.), E-Mail-Adresse, IP-Adresse.
Purposes of processing and legal basis
Wenn Sie über die Website Kontakt aufnehmen, Infomaterial oder einen Katalog anfordern, werden Ihre Angaben aus dem Kontaktformular oder aus Ihrer E‑Mail zwecks Bearbeitung der Anfrage, der damit verbundenen technischen Administration und für den Fall, dass Anschlussfragen auftauchen, erfasst und damit einhergehend von demjenigen Verantwortlichen verarbeitet, an den die Anfrage gerichtet ist. Die sonstigen während des Absendevorgangs verarbeiteten personenbezogenen Daten dienen dazu, einen Missbrauch des Kontaktformulars/ des E-Mail-Kontakts zu verhindern und die Sicherheit unserer informationstechnischen Systeme sicherzustellen.
In the case of pre-contractual measures, the processing of these data takes place in accordance with point (b) of Article 6(1) GDPR; otherwise, it takes place due to the interest of both sides in processing thereof in accordance with point (f) of Article 6(1) GDPR.
We store your personal data pursuant to this Sec. 2.2 only as long as required in order to transmit the information you have requested from us and to commence the potential business relationship with you. This contact is deemed to have been terminated when it is apparent from the circumstances that the matter in question has been clarified on a final and conclusive basis.
We collect the personal data listed in this Sec. 2.2 directly from you when you provide the personal data yourself. It is not possible to provide the services specified in this Sec. 2.2 without processing the personal data (with the exception of any voluntary information).
2.3 Applications
In the context of applications submitted via our website, but also applications submitted by other means, we process the following personal data in the manner described below.
Nature of personal data
Application information
(i) Personal information:
Name, personal/home contact information (e-mail address, phone number, mailing address).
ii) Further application-specific information:
Lebenslauf, Empfehlungsschreiben, Anschreiben, Arbeitsberechtigungsschein, vorangegangene Anstellungen, Ausbildungshistorie, gesprochene Sprachen, anstellungsrelevante Fähigkeiten und Zeugnisse.
(iii) Information provided in the further course of the application process (some of which is required by law), such as:
Date and place of birth, marital and family status, number of children, driver license information, and disability status where applicable.
Purposes of processing and legal basis
Die Verarbeitung der genannten personenbezogenen Daten im Zusammenhang mit einer Bewerbung, die per E-Mail, über eine Unternehmensseite (Social-Media-Präsenz, siehe Ziffer 2.6), oder postalisch erfolgen kann, ist erforderlich, um die Auswahl geeigneter Mitarbeiter:innen, die Mitteilung der Entscheidung über eine Bewerbung, die Koordination des Bewerbungsverfahrens (z. B. persönliches Gespräch) sowie die Begründung eines Beschäftigungsverhältnisses durchzuführen. Die Verarbeitung dieser Daten erfolgt gemäß § 26 Abs. 1 S. 1 BDSG.
Wir erheben die in dieser Ziffer 2.3 genannten personenbezogenen Daten im Bewerbungsprozess direkt von Ihnen als Bewerber:in.
Wenn Ihre Bewerbung bei uns keinen Erfolg hat, speichern wir diese personenbezogenen Daten nach Mitteilung dieser Entscheidung an Sie noch für drei Monate. Die Rechtsgrundlage für die Verarbeitung der Daten ist dann ergänzend von oben Art. 6 Abs. 1 lit. f DSGVO. Unser berechtigtes Interesse ist es diese personenbezogenen Daten gegebenenfalls in Bezug auf Rechtsstreitigkeiten mit Bewerber:innen, insbesondere im Zusammenhang mit dem Allgemeinen Gleichbehandlungsgesetz (AGG), zu verwenden.
2.4 Cookies and comparable technologies (analytics services)
(a) General information on cookies
Wir verwenden auf der Website für unterschiedliche Zwecke so genannte Cookies und vergleichbare Technologien (nachfolgend zusammengefasst unter „Cookies") for various purposes. Cookies are small text files that are placed on your device and stored by your browser. Cookies do not damage your computer, and they do not contain any viruses. Cookies serve to make our site more user-friendly, effective, and secure. Some elements of our website require it to be possible to identify the browser accessing the site even after a change of sites or pages.
(b) Information on necessary and functional cookies
(i) Necessary “session cookies”
Our website uses session cookies, which are used in particular for the functioning of language settings, to bookmark search terms, and to show and hide the cookie banner.
This takes place through processing of the language settings, the search terms entered, the number of times the page is accessed, the use of website functions, and the cookie preference through the following cookies:
uncode_privacy[consent_types]; uncode_privacyprivacy_bar.
The legal basis for these types of data processing is Sec. 25 (2) No. 2 of the German Telecommunications and Telemedia Data Protection Act (TTDSG) and/or point (f) of Article 6(1) GDPR (for use during the session in question), so that we can provide our website to you in relation to its essential functions.
The aforementioned data are processed for as long as is necessary to achieve the purpose noted above. The session cookies are generally stored until the end of your visit to the website. Depending on your browser, the default settings may be set to restore the page previously visited, which means the session cookies may also be stored for longer.
You can prevent cookies from being stored by adjusting your browser settings accordingly; if you do this, however, please note that you may not be able to use all of the functions of our website in full.
(ii) Functional “Tag Manager”
Our website also uses Google Tag Manager. Google Tag Manager is a service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Durch diesen Dienst können Website-Tags über eine Oberfläche verwaltet werden. Der Google-Tag-Manager selbst setzt keine Cookies, sondern lediglich Tags. Der Dienst sorgt für die Auslösung anderer Tags, die ihrerseits unter Umständen Daten erfassen. Der Google Tag Manager greift jedoch nicht auf diese Daten zu.
When a tag is triggered, Google may process information (including personal data). As Google only processes this information in order to enable the loading of further tags on our behalf, we have entered into an agreement on the processing of data on our behalf with Google as a processor. In this regard, it is not impossible that Google may also transfer the information to a server in a third country (with regard to the third countries and risks and the further recipients, please see the remarks on Google Analytics below). We have therefore entered into what are known as standard contractual clauses with Google to the extent necessary.
In particular, the following personal data may be processed by Google Tag Manager:
Online-Kennzeichnungen (einschließlich Cookie-Kennungen) und IP-Adresse.
We have supplemented the use of Google Tag Manager with the configuration parameter “anonymizeIP.” This means that your IP address is only collected after being truncated (shortened). In this regard, your data are processed exclusively on a pseudonymized basis. It is not possible for us to associate them with you personally.
The legal basis for the processing of your personal data based on the use of Google Tag Manager is your voluntary and informed consent pursuant to Sec. 25 (1), first sentence, TTDSG.
You can prevent the tags from being stored by adjusting your browser settings accordingly; if deactivation has taken place at the domain or cookie level, it remains in place for all tracking tags that are implemented with Google Tag Manager. However, please note that if you deactivate this feature, you may not be able to use all of the functions of our website in full.
Alternativ können Sie Ihre Einwilligung jederzeit in unserem Cookie-Consent-Tool „complianz“ widerrufen. Die Rechtmäßigkeit der bereits erfolgten Datenverarbeitungsvorgänge bleibt vom Widerruf unberührt.
You can find further detailed information about Google Tag Manager at https://www.google.de/analytics/terms/tag-manager/ and https://www.google.com/intl/de/policies/privacy/index.html
under “Data we receive based on your use of our services.”
(c) Information on performance/analytics cookies: Google Analytics: Google Analytics
Our website also collects and stores your personal data using Google’s Web analytics service for purposes of statistical analysis of user behavior and for related optimization and marketing purposes. Specifically, the following cookies are used:
Cookie | Purpose | First/ Third Party Cookie | Period | Recipient(s) outside the EU | Provider name |
gid | Dient zur Unterscheidung der Nutzenden | First | 24 hours | Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA); and Alphabet Inc (1600 Amphitheatre Parkway, Mountain View, CA 94043 USA). | Google Ireland Limited (Gordon House, 4 Barrow Street, Dublin, Ireland) |
Gat | Dient zur Unterscheidung der Nutzenden | First | 1 minute | ||
ga | Serves to control queries | First | 2 years |
and the following personal data are collected:
IP-Adresse, Datum und Uhrzeit des Seitenaufrufs, Klickpfad, Informationen über den von Ihnen verwendeten Browser und das von Ihnen verwendete Device (Gerät), besuchte Seiten, Referrer-URL (Website, über die Sie unsere Website aufgerufen haben), Standortdaten und Bestellaktivitäten.
Google uses this information to analyze visitors’ use of our website and compile reports on website activity. The analysis of the data collected allows us to compile information on the use of the individual components of our website. This helps us to continuously improve our website and its user friendliness.
We share the status of controller with Google with regard to the use of the Google service. We have entered into an agreement with Google to this end; however, it allocates full responsibility to each individual party for the processing operations assigned to that party. Google combines your use data with use data collected by other means and uses the resulting profiles to place personalized ads and prepare analyses. Your data are provided to us only in aggregated and encrypted form.
Unsere Rechtsgrundlage für die Verarbeitung Ihrer personenbezogenen Daten aufgrund der Verwendung von Google Analytics-Cookies ist Ihre freiwillige und informierte Einwilligung nach Sec. 25 (1), first sentence, TTDSG. The legal basis for the subsequent processing of your personal data using Google Analytics in the form of the reports is your voluntary and informed consent pursuant to point (a) of Article 6(1) GDPR.
You can prevent cookies from being stored by adjusting your browser settings accordingly; if you do this, however, please note that you may not be able to use all of the functions of our website in full.
Alternativ können Sie Ihre Einwilligung jederzeit in unserem Cookie-Consent-Tool [hier] widerrufen. Die Rechtmäßigkeit der bereits erfolgten Datenverarbeitungsvorgänge bleibt vom Widerruf unberührt.
Google may also use your personal data for purposes of its own, such as profiling. Please note that to do this, the Google service may transfer personal data outside the European Union/European Economic Area to what are known as “third countries” that do not have an adequate level of data protection. The data protection and privacy laws in the United States and other countries may differ from those in your country of residence. By giving consent and providing information in association with that consent, you therefore state that you agree to information concerning you being transferred, processed, used, disclosed, and stored in the United States and other countries in accordance with this privacy policy. Below please find a list of third countries to which personal data may be transferred (this may occur for various purposes, such as storage or processing):
U.S.A./ Singapur/ Chile/ Taiwan
Soweit erforderlich, haben wir mit Google Standardvertragsklauseln geschlossen. Auf diese personenbezogenen Daten können ggf. trotz der Standardvertragsklauseln auch staatliche Stellen in den USA bzw. aus den anderen Drittländern Zugriff nehmen.
For more information on how Google handles your data in the case of Google Analytics, please see Google’s privacy policy at https://support.google.com/analytics/answer/6004245?hl=de.
(d) Information on Matterport
Our website contains virtual tours, which are integrated using the portal my.matterport.com The operator of this portal is Matterport, Inc., 352 E. Java Dr. Sunnyvale, CA 94089, USA (“Matterport“).
When you click on a virtual tour on our website, a connection to Matterport’s servers is established. In the process, which of our pages you visited is communicated to the Matterport server. Matterport also receives your IP address. This applies even if you are not logged in to Matterport or do not have an account with Matterport. The information collected by Matterport is transferred to the Matterport server in the United States.
If you are logged in to your Matterport account, you allow Matterport to associate your surfing behavior directly with your personal profile. You can prevent this by logging out of your Matterport account.
The legal basis for the transfer of these data to the United States to Matterport to display the virtual tour integrated into our website is your voluntary and informed consent pursuant to Sec. 25 (1), first sentence, TTDSG (for purposes of collection) and point (a) of Article 6(1) GDPR (for purposes of transfer).
The aforementioned data are processed for transfer for as long as is necessary to achieve the purpose noted above. However, this data processing by us ends at the latest when the virtual tour is closed, and the data are erased. This means you can withdraw your consent to the processing of your personal data in connection with the visualization of a virtual tour at any time by closing the virtual tour. Withdrawal of consent does not affect the lawfulness of the data processing operations that have already taken place.
For further information on the purpose and scope of data collection and the processing of your personal data by Matterport, please see the Matterport privacy policy. It also contains further information on your rights and ways to adjust your settings to protect your privacy: matterport.com/de/legal/privacy-policy.
The data protection and privacy laws in the United States may differ from those in your country of residence. By giving consent and providing information in association with that consent, you therefore state that you agree to information concerning you being transferred, processed, used, disclosed, and stored in the United States in accordance with this privacy policy (with regard to the associated risks, please see the remarks on Google Analytics above).
2.5 Newsletter
We also process your personal data if you subscribe to our newsletter.
Art der personenbezogenen Daten
Subscription information: e-mail address, title/form of address, first name, last name,
IP address of accessing computer, date and time of registration.
Purposes of processing and legal basis
If you subscribe to our newsletter, we process the data from the entry screen and data necessary for technical reasons. These data are collected in order to send the newsletter you have ordered. Collection of other personal data within the scope of the subscription process serves to prevent abuse of the services or the e-mail address used. These data are processed in accordance with point (a) of Article 6(1) GDPR.
Subscription takes place using what is known as a double opt-in process. After you sign up, you will receive a confirmation e-mail from us, in which you are asked to reconfirm your subscription request. This entire process is documented and stored. This includes the storage of the time of subscription and confirmation and your IP address. These data are not shared with third parties.
The e-mail address and the other data you provide are stored for as long as the newsletter subscription is active.
You can withdraw consent to the processing of your personal data in connection with the sending of the newsletter at any time by unsubscribing from the newsletter. To do this, please use the link at the end of the newsletter to terminate your subscription. Withdrawal of consent does not affect the lawfulness of the data processing operations that have already taken place.
2.6 Social media
a) Icons linking to company pages and “share” icons
In addition to the website, we also maintain joint company pages (company profiles) with various social media providers so we can communicate with visitors, prospective clients and employees, and applicants who are active there and inform you of our services and open positions.
In this context, our website only uses simple links for the integrated icons (Xing, Instagram, LinkedIn) of social media providers; these links do not create a connection to the relevant social media platform when our website is loaded. Links to our YouTube videos are also only simple links, which do not create a connection to YouTube when our website is loaded.
The same applies to the “share” icons (Facebook, Pinterest, LinkedIn, Xing), which you can use to share certain content on our website via your social media account.
(b) Processing of your data when you visit our company pages
(i) Xing
If you visit such a company page of ours on Xing by clicking the social media link/simple link or directly and use the contact options provided there (including a comments function), we process your personal data there within the scope specified in Sec. 2.2 and (where applicable) 2.3.
In addition, however, the personal data concerning you that are collected via our own website (our company page) with the social media provider are also transferred to the provider of the social media platform and processed by that provider itself. It is likely that in addition to the storage of the data specifically entered by you on this social media platform, the social media provider also processes further information. If you are logged in to your personal user account with the relevant network while visiting such a social media platform, the social media platform can associate the visit with your account. If you do not wish the visit to be associated with your account in this way, you need to log out of your account before visiting our company page and possibly clear cookies. For further information on the purpose and scope of the data processing there and the further processing and use of your data, please see the privacy policy of the relevant social media provider:
Xing
Xing wird betrieben von der New Work SE, Am Strandkai 1, 20457 Hamburg, Deutschland.
Privacy policy: https://privacy.xing.com/de/datenschutzerklaerung
Finally, in the case of Xing, we also receive access to what are known as statistical data: the number of visitors to our company page, the scope of interactions, information on the countries and cities from which our visitors come and statistics on the gender makeup of our visitors), which the social media provider generates from the personal data it collects itself and provides to us in anonymized form. It is not possible for us to associate these data with individual users or access individual users.
(ii) Instagram and LinkedIn
We also process your personal data within the scope specified in Sec. 2.2 and (where applicable) 2.3 if you visit a company page of ours on Instagram or LinkedIn by clicking the social media link or directly and use the contact options provided there (including a comments function).
With regard to these company pages, we are joint controllers as defined by the GDPR with Instagram or LinkedIn, as the case may be. We have entered into agreements with Instagram and LinkedIn as the controller (or co-controller) of these company pages, setting out provisions on matters including the terms of use of the company page. If you visit our company pages on Instagram or LinkedIn, the relevant social media providers process personal data concerning you. Some of the personal data collected and processed during the use of our company pages are provided to us in aggregated form as “insights” (user statistics). The user statistics prepared (including but not limited to the following: Instagram: activity information (reactions: like/heart, comments, how shared or stored, how many accessed profile in response to a story, clicks on links in profile), demographic data; LinkedIn: posts (number of times a post has been displayed, number of times post and company have been clicked, likes, comments, shares), followers (whether organic or not, demographic data), visitors (how often the same visitor, demographic data)) are transferred to us exclusively in anonymized form. We have no access to the underlying data in each case.
Our processing of these data is based on a weighing of interests pursuant to point (f) of Article 6(1) GDPROur interest in processing these personal data lies in providing visitors/users with a contemporary source of information and means of interaction on our company pages.
For further details regarding the data processing, particularly with regard to user statistics, please see the agreements on the status of controller for purposes of data protection and privacy law:
For LinkedIn:
https://legal.linkedin.com/pages-joint-controller-addendum
For Instagram:
https://www.facebook.com/legal/terms/page_controller_addendum
You can see the privacy policies linked below for information on the extent to which the social media providers collect and process personal data in addition to this. We have no influence on whether Instagram or LinkedIn transfers personal data to third parties in this regard. In particular, it is possible that personal data are processed outside the European Union by Instagram Inc. or LinkedIn Inc., which are based in the United States.
LinkedIn is operated by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Instagram is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Privacy policy: https://privacycenter.instagram.com/
Provision of personal data by you generally takes place on a voluntary basis. As a basic principle, you are under no obligation to provide such data either by law or based on a contract or agreement. However, if you do not provide personal data, it may be the case that we cannot provide our services, or cannot provide them properly, in whole or in part.
We share your personal data with the following recipients:
4.1
We use the services of processors to process personal data on our behalf for the aforementioned purposes. We retain control over the personal data in the process and remain the controller responsible for the data processing.
4.2
To process payments for orders that have been placed, we transfer payment information to banks or payment service providers where the payment method so requires.
4.3
Where necessary, we transfer contact information to logistics companies to carry out the transportation of goods.
4.4
In individual cases, we may share the personal data that are necessary for the order with our international representatives (other companies within our group of companies) at your request. If the European Commission has not issued an adequacy decision for the third country in question outside the European Economic Area, this takes place on the basis of point (b) of Article 49(1) GDPR.
4.5
In individual cases, we transfer personal data to courts, law enforcement agencies, supervisory authorities, other government agencies, tax advisors, and attorneys, to the extent that this is legally permissible and necessary.
We will not use your personal data to make automated decisions concerning you (including profiling) that produce legal effects concerning you or similarly significantly affect you.
With regard to our processing of your personal data, you have the following rights:
6.1 Pursuant to the statutory provisions, you have the following rights:
– the right of access to your personal data: this allows you to receive a copy of the personal data concerning you that we process and to review whether we process these data lawfully;
– the right of rectification of the personal data concerning you that we process: this allows you to have incomplete or inaccurate data corrected;
– the right of erasure of your personal data: this allows you to request that we erase or remove personal data if we no longer have any reason to continue processing thereof;
– the right to object to the processing of your personal data, where the processing is based on our legitimate interests (or those of a third party) and grounds relating to your particular situation arise based on which you wish to object to the processing on the said basis. In particular, you have the right to object if we process your data for purposes of direct marketing;
– the right to restriction of processing of your personal data: this allows you to request that processing of your personal data be halted, for example if you request a determination of the accuracy thereof or the basis for processing from us; and
– under certain circumstances, the right to have your personal data transferred to a different controller.
6.2
If you have given us your consent to the processing of your personal data, you have the right to withdraw your consent at any time without the lawfulness of the processing that has occurred based on the consent prior to withdrawal thereof being affected.
6.3
You have the right to lodge a complaint with a supervisory authority with jurisdiction at any time.
